Config-driven vulnerability suppression leaves no trace in machine-readable output

`Manager.Get` loads an `osv-scanner.toml` from each scanned manifest's directory and applies its `IgnoredVulns`/`PackageOverrides` ignore directives to that directory's results. During a recursive scan this can reach directories the person running the scan didn't author (vendored deps, submodules, extracted archives, a folder added by a PR). A config placed there suppresses findings silently — currently only logged at info level, so under `--verbosity warn` or JSON/SARIF output the scan can print "no issues found" / exit 0 with no trace that anything was suppressed.

Proposal:
- Raise config-driven suppression logging to warning level (loaded config path, each suppressed vuln/package, filtered count).
- Add a `--no-config-ignore` flag that drops suppressing directives (`IgnoredVulns`, ignore flags on `PackageOverrides`) from auto-discovered configs, while leaving license overrides intact. Configs passed explicitly via `--config` stay trusted/unaffected.

Happy to submit a PR for this once discussed/assigned — closing #2997 per contributing guide since it was opened without an issue first.

Start at Manager.Get and trace how auto-discovered osv-scanner.toml directives reach recursive scan results, then review the existing --config handling and JSON/SARIF output paths. Done means warning-level records identify loaded configs and suppressed findings, --no-config-ignore disables only auto-discovered vulnerability suppressions, and explicit --config behavior remains unchanged.

Written by the indexing model from the issue text.